Security incident correlation method and device as well as network server

Abstract

The embodiment of the invention relates to security incident correlation method and device as well as a network server, wherein the method comprises the following steps of: converting a new alarm into a fact when receiving the new alarm; selecting all rules related to the fact from a preset rule base so as to form a rule set; sequentially inquiring the rules in the rule set and obtaining a security incident according to one rule when inquiring that all facts included in the rule in the rule set happen. In the embodiment of the invention, one fact corresponds to one rule set, thereby obtaining the security incident through inquiring whether all facts included in the rule in the rule set happen or not without recording an intermediate state, achieving higher processing speed and realizing online real-time matching of the security incident.

Description

technical field [0001] The embodiments of the present invention relate to the network field, in particular to a security event correlation method, device and network server. Background technique [0002] The network plays an increasingly important role in people's daily life, and at the same time, it has more and more applications in business. Network security is an important issue in network applications. In the network, the security event management platform is used to manage the alarm information reported by the alarm device. The following problems generally exist in the current security event management platform: failure to recognize normal behaviors and cause false alarms; failure to recognize single attack behaviors that trigger repeated alarms from multiple alarms; failure to recognize complex attack behaviors composed of multiple steps. Due to these problems, a large number of log files and alarm information will be generated, so that the real attack information is ...

AI Technical Summary

Problems solved by technology

The following problems generally exist in the current security event management platform: the failure to identify normal behaviors and cause false alarms; the failure to identify a single attack behavior that triggers repeated alarms from multiple alarms; the failure to identify complex attack behaviors composed of multiple steps

This method needs to record the intermediate state when matching new alarm attributes, which affects the matching speed and cannot achieve real-time matching

Images